TON_IoT Telemetry Dataset: A New Generation Dataset of IoT and IIoT for Data-Driven Intrusion Detection Systems

By Abdullah Alsaedi, Nour Moustafa, Zahir Tari, Abdun Naser Mahmood, Adnan Anwar. IEEE Access, 2020

684 citations recorded by the source corpus.

Although the Internet of Things (IoT) can increase efficiency and productivity through intelligent and remote management, it also increases the risk of cyber-attacks. The potential threats to IoT applications and the need to reduce risk have recently become an interesting research topic. It is crucial that effective Intrusion Detection Systems (IDSs) tailored to IoT applications be developed. Such IDSs require an updated and representative IoT dataset for training and evaluation. However, there is a lack of benchmark IoT and IIoT datasets for assessing IDSs-enabled IoT systems. This paper addresses this issue and proposes a new data-driven IoT/IIoT dataset with the ground truth that incorporates a label feature indicating normal and attack classes, as well as a type feature indicating the sub-classes of attacks targeting IoT/IIoT applications for multi-classification problems. The proposed dataset, which is named TON_IoT, includes Telemetry data of IoT/IIoT services, as well as Operating Systems logs and Network traffic of IoT network, collected from a realistic representation of a medium-scale network at the Cyber Range and IoT Labs at the UNSW Canberra (Australia). This paper also describes the proposed dataset of the Telemetry data of IoT/IIoT services and their characteristics. TON_IoT has various advantages that are currently lacking in the state-of-the-art datasets: i) it has various normal and attack events for different IoT/IIoT services, and ii) it includes heterogeneous data sources. We evaluated the performance of several popular Machine Learning (ML) methods and a Deep Learning model in both binary and multi-class classification problems for intrusion detection purposes using the proposed Telemetry dataset.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/d7598dc4da0e93768068ed3b640935ad77ac7841

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

CICIoT2023: A Real-Time Dataset and Benchmark for Large-Scale Attacks in IoT Environment (2023, background): “In [45], the authors proposed a new telemetry-based data-driven IoT/IIoT dataset called TON-IoT (2020).”
Federated Learning for Malware Detection in IoT Devices (2021, background): “The dataset TON_IoT [26] consists of heterogeneous data sources (network data but also sensor readings, operating system logs and telemetry data) about a network containing several IoT/IIoT devices.”
Edge-IIoTset: A New Comprehensive Realistic Cyber Security Dataset of IoT and IIoT Applications for Centralized and Federated Learning (2022, background): “Intrusion detection techniques that are based on machinelearning require training and ongoing callibration using centralized or federated learning approaches [17]–[21].”
Decentralized Federated Learning: Fundamentals, State of the Art, Frameworks, Trends, and Challenges (2022, methodology): “The authors used TON_IoT [186] and LITNET-2020 [187] to validate the robustness and efﬁciency of the framework over different cyberattack detection approaches.”
E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT (2021, methodology): “• ToN-IoT: This is a relatively new and extensive dataset that was generated in 2019 by Abdullah et al.[15], which includes different types of IoT data, such as operation system logs, telemetry data of IoT/IIoT services, as well as IoT network traffic collected from a mediumscale network at the Cybe”
Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research (2022, methodology): “[110] TON_IoT 2020 103 TON IoT dataset was constituted by the IoT traffic collected from a medium-scale network at the Cyber Range and IoT Labs of the UNSW Canberra, Australia.”